Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5…
Priority LOW 36CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06333 93rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial lxml (PyPI): 3.3.5Red Hat: 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | lxml (PyPI) | before 3.3.5 | 3.3.5 | Patch available | GHSA-57qw-cc2g-pv5p |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- lxml (PyPI) Vendor— Affected before 3.3.5 Fixed in 3.3.5 Patch available GHSA-57qw-cc2g-pv5p
CPE configurations NVD · 95
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* | up to 3.3.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.5:*:*:*:*:*:*:* | 0.5 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.5.1:*:*:*:*:*:*:* | 0.5.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.6:*:*:*:*:*:*:* | 0.6 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.7:*:*:*:*:*:*:* | 0.7 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.8:*:*:*:*:*:*:* | 0.8 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.9:*:*:*:*:*:*:* | 0.9 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.9.1:*:*:*:*:*:*:* | 0.9.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:0.9.2:*:*:*:*:*:*:* | 0.9.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | lxml |
- cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* Versions up to 3.3.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.5.1:*:*:*:*:*:*:* Versions 0.5.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·lxml
Show 85 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lxml:lxml:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.0.2:*:*:*:*:*:*:* | 1.0.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.0.3:*:*:*:*:*:*:* | 1.0.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.0.4:*:*:*:*:*:*:* | 1.0.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.1.1:*:*:*:*:*:*:* | 1.1.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.1.2:*:*:*:*:*:*:* | 1.1.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.2:*:*:*:*:*:*:* | 1.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.3:*:*:*:*:*:*:* | 1.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.3.1:*:*:*:*:*:*:* | 1.3.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.3.2:*:*:*:*:*:*:* | 1.3.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.3.3:*:*:*:*:*:*:* | 1.3.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.3.4:*:*:*:*:*:*:* | 1.3.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.3.5:*:*:*:*:*:*:* | 1.3.5 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:1.3.6:*:*:*:*:*:*:* | 1.3.6 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.2:*:*:*:*:*:*:* | 2.0.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.3:*:*:*:*:*:*:* | 2.0.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.4:*:*:*:*:*:*:* | 2.0.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.5:*:*:*:*:*:*:* | 2.0.5 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.6:*:*:*:*:*:*:* | 2.0.6 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.7:*:*:*:*:*:*:* | 2.0.7 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.8:*:*:*:*:*:*:* | 2.0.8 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.9:*:*:*:*:*:*:* | 2.0.9 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.10:*:*:*:*:*:*:* | 2.0.10 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.0.11:*:*:*:*:*:*:* | 2.0.11 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1:alpha1:*:*:*:*:*:* | 2.1 alpha1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1:beta1:*:*:*:*:*:* | 2.1 beta1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1:beta2:*:*:*:*:*:* | 2.1 beta2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1:beta3:*:*:*:*:*:* | 2.1 beta3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1.2:*:*:*:*:*:*:* | 2.1.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1.3:*:*:*:*:*:*:* | 2.1.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.1.4:*:*:*:*:*:*:* | 2.1.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2:-:*:*:*:*:*:* | 2.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2:alpha1:*:*:*:*:*:* | 2.2 alpha1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2:beta1:*:*:*:*:*:* | 2.2 beta1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2:beta2:*:*:*:*:*:* | 2.2 beta2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2:beta3:*:*:*:*:*:* | 2.2 beta3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2:beta4:*:*:*:*:*:* | 2.2 beta4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.2:*:*:*:*:*:*:* | 2.2.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.3:*:*:*:*:*:*:* | 2.2.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.4:*:*:*:*:*:*:* | 2.2.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.5:*:*:*:*:*:*:* | 2.2.5 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.6:*:*:*:*:*:*:* | 2.2.6 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.7:*:*:*:*:*:*:* | 2.2.7 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.2.8:*:*:*:*:*:*:* | 2.2.8 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3:-:*:*:*:*:*:* | 2.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3:alpha1:*:*:*:*:*:* | 2.3 alpha1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3:alpha2:*:*:*:*:*:* | 2.3 alpha2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3:beta1:*:*:*:*:*:* | 2.3 beta1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3.1:*:*:*:*:*:*:* | 2.3.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3.2:*:*:*:*:*:*:* | 2.3.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3.3:*:*:*:*:*:*:* | 2.3.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3.4:*:*:*:*:*:*:* | 2.3.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3.5:*:*:*:*:*:*:* | 2.3.5 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:2.3.6:*:*:*:*:*:*:* | 2.3.6 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.0:-:*:*:*:*:*:* | 3.0 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.0:alpha1:*:*:*:*:*:* | 3.0 alpha1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.0:alpha2:*:*:*:*:*:* | 3.0 alpha2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.0:beta1:*:*:*:*:*:* | 3.0 beta1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.0.1:*:*:*:*:*:*:* | 3.0.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.0.2:*:*:*:*:*:*:* | 3.0.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.1:beta1:*:*:*:*:*:* | 3.1 beta1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.1.0:*:*:*:*:*:*:* | 3.1.0 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.1.1:*:*:*:*:*:*:* | 3.1.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.1.2:*:*:*:*:*:*:* | 3.1.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.2.1:*:*:*:*:*:*:* | 3.2.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.2.2:*:*:*:*:*:*:* | 3.2.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.2.3:*:*:*:*:*:*:* | 3.2.3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.2.4:*:*:*:*:*:*:* | 3.2.4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.2.5:*:*:*:*:*:*:* | 3.2.5 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.0:-:*:*:*:*:*:* | 3.3.0 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.0:beta1:*:*:*:*:*:* | 3.3.0 beta1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.0:beta2:*:*:*:*:*:* | 3.3.0 beta2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.0:beta3:*:*:*:*:*:* | 3.3.0 beta3 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.0:beta4:*:*:*:*:*:* | 3.3.0 beta4 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.0:beta5:*:*:*:*:*:* | 3.3.0 beta5 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.1:*:*:*:*:*:*:* | 3.3.1 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.2:*:*:*:*:*:*:* | 3.3.2 | Vulnerable | lxml |
| cpe:2.3:a:lxml:lxml:3.3.3:*:*:*:*:*:*:* | 3.3.3 | Vulnerable | lxml |
- cpe:2.3:a:lxml:lxml:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.10:*:*:*:*:*:*:* Versions 2.0.10 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.0.11:*:*:*:*:*:*:* Versions 2.0.11 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1:alpha1:*:*:*:*:*:* Versions 2.1 alpha1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1:beta1:*:*:*:*:*:* Versions 2.1 beta1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1:beta2:*:*:*:*:*:* Versions 2.1 beta2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1:beta3:*:*:*:*:*:* Versions 2.1 beta3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2:-:*:*:*:*:*:* Versions 2.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2:alpha1:*:*:*:*:*:* Versions 2.2 alpha1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2:beta1:*:*:*:*:*:* Versions 2.2 beta1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2:beta2:*:*:*:*:*:* Versions 2.2 beta2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2:beta3:*:*:*:*:*:* Versions 2.2 beta3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2:beta4:*:*:*:*:*:* Versions 2.2 beta4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3:-:*:*:*:*:*:* Versions 2.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3:alpha1:*:*:*:*:*:* Versions 2.3 alpha1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3:alpha2:*:*:*:*:*:* Versions 2.3 alpha2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3:beta1:*:*:*:*:*:* Versions 2.3 beta1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:2.3.6:*:*:*:*:*:*:* Versions 2.3.6 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.0:alpha1:*:*:*:*:*:* Versions 3.0 alpha1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.0:alpha2:*:*:*:*:*:* Versions 3.0 alpha2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.0:beta1:*:*:*:*:*:* Versions 3.0 beta1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.1:beta1:*:*:*:*:*:* Versions 3.1 beta1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.0:-:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.0:beta1:*:*:*:*:*:* Versions 3.3.0 beta1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.0:beta2:*:*:*:*:*:* Versions 3.3.0 beta2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.0:beta3:*:*:*:*:*:* Versions 3.3.0 beta3 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.0:beta4:*:*:*:*:*:* Versions 3.3.0 beta4 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.0:beta5:*:*:*:*:*:* Versions 3.3.0 beta5 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·lxml
- cpe:2.3:a:lxml:lxml:3.3.3:*:*:*:*:*:*:* Versions 3.3.3 Vulnerable ·lxml
Remediation
- Fix · GHSA-57qw-cc2g-pv5p lxml (PyPI) Fixed in 3.3.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-3146
- 2026-10-03 Alias added: GHSA-57qw-cc2g-pv5p
References
Advisory 5
Other 16
- http://lxml.de/3.3/changes-3.3.5.html
- [oss-security] 20140509 Re: CVE request: python-lxml clean_html() input sanitization flaw
- http://advisories.mageia.org/MGASA-2014-0218.html
- 20140415 lxml (python lib) vulnerability
- https://github.com/lxml/lxml/pull/273
- https://github.com/lxml/lxml/commit/3f3082e0a67851cde26a48da3d1f4b75d8aa07ec
- https://github.com/lxml/lxml/commit/86e81ab393ba14c1be71284675851a3bdce57d69
- https://github.com/lxml/lxml/commit/e86b294f1f81b899a59925123560ff924a72f1cc
- https://github.com/lxml/lxml
- https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2014-9.yaml
- https://web.archive.org/web/20140724172044/http://secunia.com/advisories/58013
- https://web.archive.org/web/20140805110535/http://secunia.com/advisories/59008
- https://web.archive.org/web/20140806061046/http://secunia.com/advisories/58744
- https://web.archive.org/web/20141017122607/https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html
- https://web.archive.org/web/20150523055039/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:112/?name=MDVSA-2015:112
- https://web.archive.org/web/20200228180542/http://www.securityfocus.com/bid/67159
More Lxml vulnerabilities
- TI-2021-19624 HTML Cleaner allows crafted and SVG embedded scripts to pass through CVSS 3.1HIGH 8.2
- TI-2026-29705 lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files CVSS 3.1HIGH 7.5
- TI-2022-02132 NULL Pointer Dereference in lxml/lxml CVSS 3.1HIGH 7.5
- TI-2021-09882 An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. CVSS 3.1MEDIUM 6.1
- TI-2020-16868 Cross-site scripting in python-lxml CVSS 3.1MEDIUM 6.1
- TI-2018-14010 An issue was discovered in lxml before 4.2.5. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2014-3146 · CVE Program
- CVE-2014-3146 · NVD
- FIRST EPSS
- GHSA-57qw-cc2g-pv5p · GitHub Advisory Database · CC BY 4.0
- CVE-2014-3146 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences